.png%3Falt%3Dmedia%26token%3D0d7283db-77fc-4e27-ad9f-1b44e6fa8466&w=3840&q=75)
Every major blockchain in existence today shares the same dependency. Somewhere underneath the consensus mechanism, the smart contracts, and the user interface, there is a signature scheme deciding whether the entire system can be trusted.
For almost every chain, that scheme is ECDSA, or a close relative like Ed25519. Both rely on elliptic curve mathematics. Both produce small, fast signatures, around 64 to 65 bytes. Both were never designed with quantum computers in mind, because for most of their history, they didn't need to be.
That is changing, and the change is structural, not incremental.
What a signature actually protects
When you send a transaction, you are not just moving value. You are producing a mathematical proof, generated from your private key, that the network can check using your public key. The chain accepts the transaction because the proof checks out.
The entire system works because of one assumption: that knowing someone's public key gives you no practical way to work out their private key.
ECDSA relies on a specific hard problem called the elliptic curve discrete logarithm problem. For a classical computer, solving it for a 256-bit key, the size used in Bitcoin and Ethereum, would take longer than the universe has existed. That has been true for over a decade, and it is the entire reason these systems are considered secure.
It was never proven secure against a quantum computer. It was just never tested against one, because none existed.
What changes with Shor's algorithm
In 1994, mathematician Peter Shor published an algorithm that solves exactly this category of problem, but on a quantum computer rather than a classical one. Shor's algorithm doesn't search for an answer the way a classical computer would. It uses quantum superposition to evaluate the structure of the problem directly, and it solves it in polynomial time rather than exponential time.
That distinction matters more than its technical phrasing suggests. Exponential versus polynomial is not a difference in speed. It is the difference between a problem that stays out of reach forever and one that becomes routine.
Run Shor's algorithm on a sufficiently capable, fault-tolerant quantum computer, and deriving a private key from an exposed public key stops being theoretical. The estimated qubit requirement for this specific attack has fallen sharply in the last several years, from roughly 20 million physical qubits in 2019 to estimates under 500,000 more recently, with some 2026 research placing it lower still. Several of the organizations building quantum hardware, including major cloud and chip providers, have set internal deadlines for their own cryptographic transitions before the end of this decade.
That timeline is not abstract. It is the basis for engineering decisions being made right now, by the same labs racing to build the hardware in the first place.
Why this is already a live exposure, not a future one
Blockchains are immutable by design. Every transaction ever sent is permanently recorded, and every public key ever used to sign a transaction is permanently visible on that record.
This means the relevant question is not only what happens to transactions sent after a capable quantum computer exists. It is what happens to the transactions already sent. An adversary does not need a quantum computer today to benefit from today's data. They need to capture and store it today, and decrypt it whenever the hardware catches up. This approach has a name in cryptographic circles: harvest now, decrypt later.
Millions of Bitcoin already sit in addresses with exposed public keys, the direct result of reused addresses or specific transaction types that reveal the key before quantum computing was ever a consideration. For any chain still operating on classical signatures, every day of activity adds to this permanent, growing body of exposed cryptographic material. The exposure compounds. It does not reset.
Why migrating an existing chain is harder than replacing an algorithm
It would be reasonable to assume the fix is simple: select a quantum-resistant signature scheme and have every chain adopt it. NIST has, in fact, already standardized the replacements. ML-DSA (Module-Lattice-Based Digital Signature Algorithm, formalized as FIPS 204) and ML-KEM (Module-Lattice-Based Key-Encapsulation Mechanism, formalized as FIPS 203) emerged from a multi-year, public evaluation process and are now the official US government standards. The algorithms exist.
The difficulty is not algorithmic. It is structural, and it is also a matter of cost. ML-DSA signatures at the highest security tier, ML-DSA-87, run to roughly 4,600 bytes, against ECDSA's 65. Public keys grow from roughly 33 bytes to roughly 2,592 bytes. On an EVM-style chain, the gas cost of verifying a transaction rises from around 3,000 to around 42,000. That is not a marginal overhead. It is a real, honest tax on every single transaction, and it has to be absorbed somewhere in the system's throughput.
On most chains, a wallet's address is derived directly from its public key. Changing the signature scheme changes the address format, which means every existing wallet, every exchange integration, and every smart contract referencing an address needs to migrate. That is not a software patch. It is closer to a hard fork with network-wide coordination requirements, and someone, eventually, has to decide when the old signature scheme stops being accepted. No major chain has made that call yet.
There is a second, less discussed problem underneath this one. Large validator networks, including Ethereum's, rely on a technique called signature aggregation to function efficiently. Ethereum has well over 900,000 active validators, and verifying each one's signature individually, every block, would be prohibitively expensive. Instead, a scheme called BLS aggregation compresses thousands of individual signatures into a single compact signature that the network verifies once.
Post-quantum signature schemes do not aggregate the same way. There is no mature post-quantum equivalent to BLS aggregation yet. Without it, a migrated network would need to verify every validator's signature separately, at the larger ML-DSA size and gas cost described above. Block sizes grow. Verification time grows. The cost compounds precisely at the layer that makes large-scale consensus practical in the first place.
None of this means migration is the wrong approach. It means migration is slow, expensive, and structurally difficult, and the timeline for the threat is not waiting for it to finish.
What it means to build post-quantum from genesis
Naoris is a Layer 1 blockchain that did not start from classical cryptography and plan a transition. Post-quantum cryptography was enforced at the protocol level from the first block.
The chain uses ML-DSA-87, the highest security tier NIST defines for the standard, corresponding to NIST Level 5, for transaction authorization. It is built on lattice mathematics rather than elliptic curves. Lattice-based problems, unlike the elliptic curve discrete logarithm problem underneath ECDSA, have no known efficient solution on either classical or quantum computers, which is the specific property that earned them NIST's selection after that multi-year, publicly scrutinized evaluation process.
That choice carries the same honest cost outlined above: roughly 4,600-byte signatures, roughly 2,592-byte public keys, and roughly 42,000 gas per transaction, against ECDSA's 65 bytes, 33 bytes, and 3,000 gas. Naoris does not avoid that cost. The architecture, including optimized verification paths and session-based validator communication, was designed around it from day one, rather than retrofitted to absorb it later on a system sized for the smaller, classical signature.
Because there was never a classical-only period to migrate away from, there is no historical window of exposed, breakable signatures sitting permanently on the Naoris ledger. The chain's record does not carry the same accumulating liability that a migrated chain inherits from its own history.
This extends beyond user transactions. Validators on Naoris communicate using a protocol called dPoSec, which establishes encrypted sessions between nodes using ML-KEM for the key exchange itself, encrypts the actual messages with AES-256-GCM, and signs them with ML-DSA. The infrastructure coordinating the chain is built on the same NIST Level 5 cryptographic foundation as the wallet layer, rather than left on classical assumptions because it is the part users never see.
Compatibility without compromise
A natural concern with any post-quantum chain is whether building on it requires abandoning the existing developer ecosystem. On Naoris, it does not.
The chain remains EVM-compatible. Solidity, Hardhat, Foundry, and the existing tooling developers already use work without modification. What changes sits beneath the interface, not on top of it.
Where this leaves the rest of the industry
The chains exploring post-quantum cryptography today are, in most cases, doing serious and necessary work. The standards exist because of years of cryptographic research conducted in the open. The engineering challenges around migration, signature size, and aggregation are real, and solving them properly, at the cost structure outlined above, will take time.
The question Naoris was built to answer is a narrower one: what does a blockchain look like if it never has to solve that migration problem at all, because the cryptography was right from the start.
Naoris is a Layer 1 blockchain built on that premise. Post-quantum cryptography enforced at the protocol level, across transaction authorization, validator communication, and system-level trust, from genesis.
The transition the rest of the industry is working toward is the environment Naoris already operates in.
Where the network stands today
Naoris mainnet is operating in its initial phase, with validator participation currently invite-only as the network forms under controlled conditions.
Developer access is opening next. SDKs, documentation, and tooling will roll out as the network expands, giving builders a way to deploy on a chain that is natively post-quantum rather than retrofitting one that isn't.
is the economic engine behind that infrastructure: the token that secures the network, aligns validator incentives, and underwrites a post-quantum world that has to be built, not assumed.
About Naoris Protocol
Naoris Protocol is the first Sub-Zero Layer 1 blockchain and decentralized post-quantum infrastructure, designed to secure digital assets, applications, and systems across the entire decentralized stack. Operating at the Sub-Zero Layer, below layers L0 to L3 it secures blockchain transactions and Web3 & Web2 infrastructure, including DEXes, bridges, and validators, enterprise cloud and IoT networks. By transforming every device into a trusted validator node, our Post-Quantum infrastructure leverages the cutting-edge dPoSec consensus and Decentralized Swarm AI, to set a new standard in transparency, trust, and security, preparing Web3 and Web2 for a Post-Quantum future.
Want to learn more? Visit our
or check out our
Stay connected: